What should be included in the initial incident report after a security event?

• A. Date, time, location, people involved, actions taken, outcomes; signed and timestamped.
• B. Date and location only; no details.
• C. A narrative with no dates or names.
• D. Date, time, location, people involved, actions taken, outcomes, and notification to supervisors; signed.

Answer: (D)

The essential idea is that an initial incident report should capture a complete, verifiable record of what happened, how it was handled, and who needs to know about it, all in a timely way. Including date, time, location, people involved, actions taken, and outcomes creates a clear timeline and situational context. Adding notification to supervisors ensures proper escalation, oversight, and follow-up actions, which are crucial in security responses. Signing the report authenticates it and locks in the author and time of preparation, supporting accountability and future review.

This is why the best choice stands out: it includes all the core factual elements plus the important step of notifying supervisors, and it is signed to confirm authorship and timing. The other options lack one or more of these essential pieces—limited details, missing dates or names, a narrative without key identifiers, or omitting supervisor notification—making them incomplete for an initial incident record and its intended use in investigation, accountability, and management.